{
  "slug": "kani",
  "name": "Kani",
  "tagline": "Bounded model checker for Rust",
  "maintainer": "AWS",
  "url": "https://github.com/model-checking/kani",
  "repo": "https://github.com/model-checking/kani",
  "category": "implementations",
  "targets": [
    "Rust",
    "Rust standard library verification challenge",
    "AWS Rust libraries"
  ],
  "approach": "Bounded model checking (CBMC backend) for panics, memory safety and user assertions",
  "license": "Open source (Apache-2.0 / MIT)",
  "status": "Active",
  "summary": "Kani is AWS's bounded model checker for Rust. It proves absence of panics, undefined behaviour and violated assertions within loop bounds, with no specification language to learn, and is used across AWS's Rust libraries and the Rust standard library verification challenge.",
  "details": [
    "Kani is the cheapest meaningful verification for Rust ZK and cryptographic code: unsafe blocks, arithmetic overflow and indexing errors are exactly what it catches."
  ],
  "strengths": [
    "Low effort, high value on unsafe and arithmetic code.",
    "Concrete counterexamples.",
    "AWS-backed, well maintained."
  ],
  "limits": [
    "Bounded: no guarantee beyond the unwinding depth.",
    "No functional correctness against a cryptographic spec.",
    "Struggles with large state spaces."
  ],
  "fit": [
    "Run Kani on every Rust crate in a prover or library; pair with hax or Aeneas for correctness."
  ],
  "references": [
    [
      "Kani repository",
      "https://github.com/model-checking/kani"
    ]
  ],
  "category_name": "Verified implementations",
  "page": "https://sorryfree.com/frameworks/kani/",
  "updated": "2026-09-13"
}